hub v0.18.0: app-email passthrough POST /api/v1/mail → Resend SMTP

Raw-MIME passthrough (STARTTLS, AUTH LOGIN) — separate from the notify HTTP-API
alert path (which drops inline CID images). Per-customer token-bucket rate limit,
From-header allowlist backstop. Resend key stays hub-side. No new external dep.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

hub/internal/api/handler.go

@@ -15,6 +15,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-hub/internal/assets"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/configgen"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/mailrelay"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/notify"
 	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
 )
@@ -43,6 +44,11 @@ type Handler struct {
 	dispatcher       *notify.Dispatcher
 	assetsMgr        *assets.Manager
 	latestVersion    LatestVersionProvider
+
+	// App-email passthrough (POST /api/v1/mail). nil sender = endpoint returns 503.
+	mailSender    mailrelay.Sender
+	mailLimiter   *mailRateLimiter
+	mailFromAllow map[string]bool
 }
 
 // SetLatestVersionProvider wires the registry version checker so the controller report ACK can
@@ -183,6 +189,8 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		h.handleAdminEnqueueJob(w, r, hostID)
 	case r.Method == http.MethodPost && path == "/event":
 		h.handleEvent(w, r)
+	case r.Method == http.MethodPost && path == "/mail":
+		h.handleMail(w, r)
 	case r.Method == http.MethodPost && path == "/notify":
 		h.handleNotify(w, r)
 	case r.Method == http.MethodPost && path == "/preferences":